Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

20% of all Node.js modules found vulnerable to injection attacks

blog.acolyer.org

Post reply on HN
Print view View original

21–30 of 42 posts

Re: 20% of all Node.js modules found vulnerable to injection attacks

#21

Post by minimaxir »

crispyporkbites wrote: post #16

This was posted 9 hours ago with the paper title as the name, and got 3 upvotes: https://news.ycombinator.com/item?id=16566587 I thought it was interesting and relevant for this audience, so I put a more sensational (but arguably accurate - you can argue the semantics of vulnerable all day) headline in the title to grab HN reader's attention. Now it is top of the front page with 40 votes in 25 minutes. If you want to…

Keep in mind that "9 hours ago" is after midnight/close to midnight for a large portion of the HN user base, so a small number of upvotes is not surprising.

Re: 20% of all Node.js modules found vulnerable to injection attacks

#22

Post by inetknght »

Ajedi32 wrote: post #18
bri3d wrote: post #3

This headline is entirely false - 20% of Node modules use 'eval' or 'exec'. While these are certainly less secure and a strong secure coding standard would probably ban them or at least reduce their use, it's entirely possible to use both in safe ways.

It's not even that. It's more like "20% of Node modules use _or include a module somewhere in their dependency chain which uses_ 'eval' or 'exec'". So if my backup utility happens to depend on a wrapper library for node's Child Process module (which probably doesn't sanitize its inputs, as that would break quite a bit of functionality), it's considered "vulnerable".

And why shouldn't it be?

Re: 20% of all Node.js modules found vulnerable to injection attacks

#23

Post by Ajedi32 »

inetknght wrote: post #22
Ajedi32 wrote: post #18

Earlier quoted context omitted.

It's not even that. It's more like "20% of Node modules use _or include a module somewhere in their dependency chain which uses_ 'eval' or 'exec'". So if my backup utility happens to depend on a wrapper library for node's Child Process module (which probably doesn't sanitize its inputs, as that would break quite a bit of functionality), it's considered "vulnerable".

And why shouldn't it be?

Maybe because it's not sending user input into the "vulnerable" API? Or because it's not even calling the "vulnerable" API in the first place? Or because it's a system utility which will never be exposed to untrusted user input?

Re: 20% of all Node.js modules found vulnerable to injection attacks

#24

Post by crispyporkbites »

minimaxir wrote: post #21
crispyporkbites wrote: post #16

This was posted 9 hours ago with the paper title as the name, and got 3 upvotes: https://news.ycombinator.com/item?id=16566587 I thought it was interesting and relevant for this audience, so I put a more sensational (but arguably accurate - you can argue the semantics of vulnerable all day) headline in the title to grab HN reader's attention. Now it is top of the front page with 40 votes in 25 minutes. If you want to…

Keep in mind that "9 hours ago" is after midnight/close to midnight for a large portion of the HN user base, so a small number of upvotes is not surprising.

But shouldn't the number of stories posted then be lower, which means it stays on /new for longer and gets more visibility?

Re: 20% of all Node.js modules found vulnerable to injection attacks

#25

Post by crispyporkbites »

msla wrote: post #20
dspillett wrote: post #19

Earlier quoted context omitted.

So basically: click-bait / vote-bait works, even with audiences that I expect to have a larger degree of technical literacy overall than the general populace. Sometimes I worry about humanity!

Upvote is commonly used to mean "read it later" by this audience. It is by no means a vote on quality.

Is it? How do you see your upvoted content to read later?

Re: 20% of all Node.js modules found vulnerable to injection attacks

#26

Post by larrykwg »

The research paper was accepted at NDSS, so thats something.

Here is the video of the conference: https://www.youtube.com/watch?v=xVfLW2JhBq8

IMHO static code analysis for this seems utterly useless, dead-end path to improve real-world NodeJS security.

But this is definitely not a security software company trying to spread FUD like some suspecting here

Re: 20% of all Node.js modules found vulnerable to injection attacks

#27

Post by minimaxir »

crispyporkbites wrote: post #24
minimaxir wrote: post #21

Earlier quoted context omitted.

Keep in mind that "9 hours ago" is after midnight/close to midnight for a large portion of the HN user base, so a small number of upvotes is not surprising.

But shouldn't the number of stories posted then be lower, which means it stays on /new for longer and gets more visibility?

More visibility is not quite correct: although it is on /new for longer, the number of people reading /new is much fewer, too.

Re: 20% of all Node.js modules found vulnerable to injection attacks

#28

Post by minimaxir »

msla wrote: post #20
dspillett wrote: post #19

Earlier quoted context omitted.

So basically: click-bait / vote-bait works, even with audiences that I expect to have a larger degree of technical literacy overall than the general populace. Sometimes I worry about humanity!

Upvote is commonly used to mean "read it later" by this audience. It is by no means a vote on quality.

This is an incorrect use of absolutes.

Re: 20% of all Node.js modules found vulnerable to injection attacks

#29

Post by acdha »

tonyarkles wrote: post #4
bri3d wrote: post #3

This headline is entirely false - 20% of Node modules use 'eval' or 'exec'. While these are certainly less secure and a strong secure coding standard would probably ban them or at least reduce their use, it's entirely possible to use both in safe ways.

Further on: > 18,924 of all 51,627 call sites are found to be statically safe (36.66%) > The templates for the vast majority of call sites have at most one hole, and very few templates contain more than five. If you've got a dependency that calls eval or exec, those aren't great odds that they're doing it safely.

That still requires you to know whether either is being called with user-provided values before you can say it's unsafe.

If, for example, someone had a utility which resized user-uploaded images you couldn't say simply calling exec to run something like ImageMagick was unsafe before checking whether it used the user's filename.

Re: 20% of all Node.js modules found vulnerable to injection attacks

#30

Post by grzm »

crispyporkbites wrote: post #25
msla wrote: post #20

Earlier quoted context omitted.

Upvote is commonly used to mean "read it later" by this audience. It is by no means a vote on quality.

Is it? How do you see your upvoted content to read later?

In your profile there's a link to upvoted submissions.
Post reply on HN